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I. introduction 

A. COMBAT SURVIVABILITY. . ..A TECHNOLOGY ISSUE 

In the skies today and or. the drawing beards tor 
tomorrow are military aircraft that are technological 
marvels. The F-1S, and F/A-18 are superior fighter and 
attack aircraft that employ the very latest in 
state-of-the-art technologies in computers, flight control 
systems, engines, and structural materials. These machines 
have been optimized to levels heretofore unobtainable. 
Performance has been built-in to these aircraft. And so has 

something else, Survivability. These aircraft were 

designed tc perform their assigned combat missions in the 
face of modern arsenals and tc return to their bases to fly 
again. However, the question must be asked, have these 
aircraft designs realized the utmost in survivability 
benefits that modern digital systems technologies have to 
offer? 

Because history has shown that the importance of 
survivability has sometimes been forgotten or neglected in 
the design and development of military aircraft in 
peacetime, it is incumbent upon the aircaft designer, the 
military program manager, and the combat aviator to ensure 
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that today's technological advances, particularly ir. the 
application cf computer augmented flight control systems, 
continue to provide the survivability enhancement features 
that will keep the cutting edge of our nation's defense 
keen . 

3. 0. S. MILITARY S U RV IV AEIL IT Y POLICY 

Survivability has been increasingly emphasized by the 
U.S. Armed Services in recent years. The Department of 
Defense and the Military Service Branches have established 
firm survivability policies regarding arms acquisitions. 
The primary objective of the (J. S. Military Survivability 
Policy is to ensure that effective surviva bility enhancemen 
features are incorporated in current and all future U. S. 
weapons systems. 

A triservice organization, the Joint Technical 
Coordinating Group on Aircraft Survivability (JTC3/AS) , 
created in 1971, has brought together the Dest expertise i 
each of the service branches to plan and execute a 
comprehensive program to increase the survivability of 
current and future aircraft assets. Within the JTCG/AS 
charter are tasks to develop design criteria and improved 
technology to increase the survivability of future comba- 
aircraft and weapons systems. 
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C. SURVIVABILITY RE QUI RE MENTS/G UIDEL INES /ST AND ARD S 

Survivability requirements for airborne weapon systems 
have been specifies in different ways by each branch of the 
Armed Services. The Navy established AERONAUTICAL 
REQUIREMENT (AR)-107, "Navy Aircraft 

Survivability/Vulnsrability (Nuclear/Ncnnuclear) ," ir. 1974. 
MIL-STD- 2072 (AS) , "Military Standard: Survi vabili-. y , 

Aircraft; Establishment and Conduct of Programs for," 
superseded AR-107 in 1977. In 1981, The Department of 
Defense issued MIL-STD-2069, "Requirements for Aircraft 
Nonnuclear Survivability Programs." Each document was 
prepared in recognition of the need for a standardized 
systems approach to improving the survivabili-y of U.S. 
military aircraft. 

DOD MIL-STD-2069 provided guidelines and requirements 
for establishing and conducting aircraft survivability 
programs. Applicability cf the principles contained therein 
apply to all major weapons system acquisition programs and 
is the standard invoked in contractual agreements regarding 
aircraft armaments. 

Various forms of handbooks have been prepared to provide 
military planners and industrial designers with the 
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information and guidance nsedad in incorporating 
survivability featuras into new and existing systems. The 
Air Force Systems Command has published a design handbook 
series, DH-1 through DH-3 (with supplements) for use with 
Air Force programs. The Army has publisaed a "Survive bilit 
Design Guide for Army Aircraft," USAAMRDL TR-71-41. The 
Navy established MIL-HDBK-268 (AS), "Survivability 
Enhancement, Aircraft Conventional Weapons Threats, Design 
and Evaluation Guidelines," in August 1982 for use in the 
acquisition process of Naval aircraft systems. Jointly, th 
three services work within the guidelines established by th 
JTCG/AS and published in several volumes as 
DOD-MIL-HDBK-336, "Survivability, Aircraft, Nonnuclear, 
(Various) . " 

D. WHY BE CONCERNED WITH AIRCRAFT FLIGHT CONTROL SYSTEMS? 

The essential question of flight control survivability 
was derived by the author from a statement eminating from a 
analysis of Southeast Asia combat files maintained by the 
Combat Data and Information Center (CDIC) . The statement 
attributed approximately 25% of all aircraft lost in 
Southeast Asia to the functional loss of the aircraft's 
flight control system as a result of combat induced damage 
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This percentage figure equated to nearly 500 aircraft. 
Preliminary investigation revealed than the flight control 
system of most conventional combat aircraft contributed 
approximately 5^ to the aircraft's total presented area. 
The disproportionali ty of the two figures generated a 
concern that culminated in the development of the guidelines 
contained herein. 

E. PURPOSE 

The purpose of this treatise is to present in a single 
document guidelines for the development of aircraft flight 
control systems (FCS) with specific emphasis on increasing 
the combat survivability of aircraft equipped with 
Fly-By-Mire (FEW) flight control systems. 

F. SCOPE 

The scope of this effort was limited to nonnuclear 
weapons effects considerations. The Fly-by-Wire flight 
control systems development guidelines presented within were 
developed in connection with the damage causing mechanisms 
associated with conventional weapons systems, self generated 
electromagnetic interference (EMI) phenomena, and normal 
inflight environmental/meteorological conditions to be 
expected in the combat aircraft’s operating environment. 
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II. FUNDAMENTAL SURVIVABILITY CONCEPTS 
A. WHAT IS AIRCRAFT COMBAT SURVIVABILITY? 

V 

Aircraft combat survivability has beer defined as "the 
capability of an aircraft (weapon system) to avoid and/or 
withstand a man-made hostile environment” [Ref. 1]. 
Paramount in this definition is the ability "to avoid and/or 
withstand." The inability "to avoid," the hostile 
environment is referred to as susceptibility. The inability 
"to withstand," the hostile environment is referred to as 
vulnerability. 

Susceptibility, often measured as the probability of 
being hit, Ph , can be divided into three general categories: 

(1) Defensive weapon system threat activity 

(2) Defection, identification, and tracking by 
defensive weapon systems 

(3) Engagement by defensive weapon systems (i.e., 
missile launch or gun firing; warhead guidance; 
warhead impact or detonation) 

The susceptibility of an aircraft can be influenced by 
the aircraft's signatures, the tactics and supporting forces 
employed, and the integral survivability enhancement 
equipment carried on or within the aircraft. Small size. 
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increased maneuverability, low visual/radar/aural’/ir f rar sd 
signatures, terrain ma sking/ta rrain following tactics, 
active/passive electronic countermeasures, decoys, and 
antiradiation missiles are but a limited selection of -he 
means to reduce an aircraft's susceptibility. 

Vulnerability, often measured as the probability of 
being killed if hit, Pk/h , is a direct function and measure 
of the aircaft's design, and any survivability enhancement 
feature that reduces the amount and effect of damage induced 
by an enemy's weapon systems damage mechanisms. 
Vulnerability is influenced by the ability of a system to 
continue to operate after being hit and by design features 
and equipment that prevent or suppress damage. A flight 
control system that continues to function after sustaining a 
hit by a damage mechanism on one of its components is an 
example of reduced aircraft vulnerability. 

B. SURVIVABILITY ENHANCEMENT CONCEPTS 

Survivability enhancements have been generally 
categorized as any feature of an aircraft, any equipment 
carried, any tactic employed, or any combination thereof 
that reduces the susceptibility and/or the vulnerability of 
an aircraft. Survivability enhancements can be separately 
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concentrated into either suscep tibility reduction features 
or vulnerability reduction features. Those specific 
susceptibility and vulnerability reduction features can be 
summarized genetically into conceptual elements. The firs 
of the two categories relating the major survivability 
enhancement concepts is listed in Table I. 

TABLE I 

Survivability Enhancement Concepts - Susceptibility 

Reduct ion 



(1) 


Signature Reduction 




(2) 


Warning Receivers 




(3) 


Electronic Countermeasures 


Devices 


(4) 


Expendables 




(5) 


Tactics 




(6) 


Threat Suppression 




As presented 


in Table I, a reduction in 


an aircraft's 


susceptibility 


can be brought about by dec 


reasing its 


detectability th 


rough signature reduction. 


Reducing an 


aircraft's abili 


ty to be detected and tracke 


d by an enemy 


can best be accomplished in the design 


process . 


Incorporation of 


quieter, smokeless engines. 


utilizing rada 
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absorbent materials, eliminating sharp edges (corner 
reflectors), and prescribing low IP. reflective paint schemes 
are examples of this technique. Alerting the crew to 
impending missile or gun activity can be achieved through 
the use of appropriately selected warning receivers. 
Incorporating electronic countermeasures devices, such as 
noise jammers and deception repeaters, can degrade or 
prevent an enemy’s defensive systems ability to achieve a 
suitable weapons firing solution. Expendables, in the form 
of chaff, infrared flares, and off-board decoy devices, can 
confuse and degrade an enemy's weapon systems by masking an 
aircraft's true identity or location. Minimization of 
exposure to an enemy's defensive network can be achieved 
through a suitable selection of tactics alternatives. 
Examples of this technique can be found in operational plans 
that take advantage of terrain following/terrain masking 
flight profiles and that utilize stand-off or 
la unch-and-leave weapons. The impact of crew skill and 
experience and the increased performance capabilities of the 
modern fighter/attack aircraft, brought about, in part, by 
the incorporation of FBW flight control systems technology, 
can have a major impact on tactics selection. Threat 
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suppression, the ability to actively deny the enemy an 
unhindered opportunity to fire his weapons, can be achieved 
by attacking his weapons emplacements with such means as 
anti-radiation missiles and coordinated supporting fire from 
ancillary units. 

The six concepts described above comprise susceptibility 
reduction, the avoidance portion of the survivability dual. 
Completing the dual are six vulnerability reduction 
concepts. These six complementary concepts are presented in 
Table II. 

TABLE II 

Survivability Enhancement Concepts - Vj lnera bility Seduction 



(1) 


Component 


Loca 


tion 




(2) 


C ompone nt 


Shis 


lding 




(3) 


Component 


Redu 


ndancy 




(4) 


Compone nt 


Elim 


ination 




(5) 


Passive Damage 


Suppress! 


on 


(6) 


Active Damage 


Suppressio 


n 


lit j 


r reduction 


can 


be best 


ac 



design phases of an aircraft's development. Judici 
selection of the location of critical components to mi 



the 

ous 

nimize 



19 



the possibility of. damage and shielding those critical 
components to prevent damage mechanisms from striking -.he 
components, rendering them unser vicable, are techniques most 
suited to be achieved during the early design phases. 
Incorporation of more than one component to perform a 
critical function (component redundancy) can have a major 
impact on the vulnerability of an aircraft or aircraft 
system. Additional reductions may be achieved through the 
elimination of components entirely (component elimination) . 
Passive and active damage suppression reduces aircraft 
vulnerability either by controlling the effects of damage 
mechanisms or by reducing or preventing the subsequent 
spread of further damage causing effects. 

Suitable attainment of an appropriate level of aircraft 
survivability can be achieved through the incorporation of 
elements from each of the survivability enhancement concepts 
described. However, it must be notei that not all 
survivability enhancement concepts are necessary or 
appropriate for any particular aircraft type on any 
particular mission. Paradoxically, a reduction in 
vulnerability may lead to a greater degree of 
susceptibility, such as the case faced by the designer when 
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adding large amounts of armor plate to an aircraft, thereby 
increasing the ability to tolerate a hit, but making the 
aircraft more susceptible to being hit by reducing its 
speed. Consequently, the early identification and 
successful incorporation of those survivability enhancement 
features that most significantly increase the survivability 
of the aircraft's flight control system and increase the 
mission effectiveness of the combat aircraft as a weapons 
system is to be regarded as a goal of the survivability 
discipline . 
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III. FLIGHT CONTROL SYSTEMS 
A. FLIGHT CCNTRCL BASICS 

Flight path control of an aircraft is accomplished by 
means of a complex series of electrical, hydraulic, and 
mechanical devices collectively titled the flight control 
system (FCS) . These basic elements, when transformed into 
sensors, signal paths, actuators, and surface panels, 
provide the means by which the pilot comaiands an aircraft 
in-flight about the three axes of motion. 

Conventional military aircraft utilize three primary 
control surfaces to control the three dimensional motion of 
the aircraft: the elevators, the rudder and the ailerons. A 
right-hand orthogonal axis system and the motions produced 
by the associated control surfaces are illustrated in Figure 
3 . 1 . 

Deviations from the basic control surfaces are functions 
of the geometric shape of the aircraft. In some aircraft 
configurations, the elevators are replaced by a solid 
horizontal tail, designated either a stabilator or 
stabilizer by the manufacturer, which moves as a single unit 
to provide pitch control. In some aircraft, the tail 
surfaces can be controlled either symmetrically or 
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Figure 3.1. Beference Axes/Control Surface Deflections 

assymmetr ically to provide pitch and roll control. This 
type of tail surface is known as a differential stabilator. 
Tailless aircraft employ elevons in place of ailerons and 
elevators to provide pitch and roll control. Flaperons 
replace ailerons in still ether designs. 

Additional surfaces, such as speedbrakes, spoilers, 
leading and trailing edge flaps, and leading edge slats, are 
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classified as secondary or auxiliary control surfaces. 
These devices provide an aircraft a means of speed and 
direct lift control, and can be used as back-up control 
surfaces. Despite the nomenclature and physical 
differences, the primary function of a particular control 
system configuration remains to guide the aircraft in three 
dimensional flight. 

B. MECHANICAL FLI3HT CONTROL SYSTEM BASICS 
Conventional flight control surface movements are 

commanded by the pilot through the control column and 
control pedals. Movement of the elevator and ailerons is 
commanded by means of a stick or wheel controller, and 
movement of the rudder is prescribed by a pair of rudder 
pedals. The basic mechanization scheme is illustrated in 
Figure 3.2. The control column and rudder pedals are 
mechanically linked to the control surfaces by cables, 
pushrods, and bellcranks as illustrated in Figure 3.3 for a 
longitudinal control system. 

C. POWER- ASSISTED CONTROL SYSTEM BASICS 

Most high speed military combat aircraft require some 
form of powered flight control system to give the pilot 
adequate control of the aircraft throughout the flight 
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MECHANICAL POWER AND CONTROL: 



HINGE 

ENGINE MOMENT 




Mechanical 



Figure 3.2. Mechanical Flight Control Mechanization 




Figure 3.3. Mechanical Longitudinal Control System 
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envelope. Conventional power- assisted control system 
designs usually derive the additional power by means of 
hydro-mechanical devices. The fundamental configuration is 
depicted in Figure 3.4. The hydraulic pump, selector valve, 
servcactuators, and associated plumbing, while adding weight 
and complexity to the control system, provide the additional 
power required. Artificial feel devices are generally 
incorporated in the mechanical linkage to provide feedback 
to the pilot. Figure 3.5 illustrates the basic 
mechanization of a conventional hydraulic powered 
longitudinal control system. 

D. FLY-BY-WIRE (FBW) CONTROL SYSTEM BASICS 

Many modern, high technology combat aircraft employ 
fly-by-wire flight control systems. In the basic 
configuration, illustrated in Figure 3.6, the pilot is 
linked to the control actuators by electrical wires. 

The electrical wiring provides the control signal paths that, 
transmit the pilot's commands to the servoactuator s . 
Sophisticated artificial feel devices provide feedback to 
the pilot. The basic FBW control system configuration is 
electrically noisy, and the aircraft is prone to pilot 
induced oscillations. To aid in the controllability of the 
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CONVENTIONAL HYDRAULICS: A centralized system with 

engine mounted pumps to 
supply hydraulic fluid 
through metal lines at 
3000 psi. 



HYDRO-MECHANICAL 

ENGINE PUMP VALVE ACTUATOR 




PILOT MECHANICAL 

CONTROLLER 





Mechanical 
Hydraul ic 



Figure 3.4. Hydraulic Power System Hechanization 



aircraft, a series of electronic filters is often inserted 
in the system between the pilot and the electro-mechanical 
selector device to reduce noise transients. 

E. COMPUTER AUGMENTED FBW CONTROL SYSTEM BASICS 

High speed computers, in-line with the basic FBW flight 
control system, may be used to either augment or provide the 
controllability of the aircraft. Computer monitoring of the 
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Figure 3.5. Hydraulic Powered Longitudinal Control System 

flight environment through the addition of motion and rate 
sensors coupled to the computer relieves the pilot of the 
responsibility to continuously monitor his flight path. 

One of the most sophisticated applications of a digital 
computer augmented FBW flight control system in a military 
combat aircraft is the McDonnell-Douglas F/A-18 "Hornet." 
This aircraft employs high speed digital computers in-line 
with a state-of-the-art FBW system to provide the very 
latest in high performance aircraft flight control systems 
technology. 
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FLY-BY-WIRE: The conventional mechanical linkage 

between the pilot's control input 
and mechanical controller is replaced 
by an electrical signal used to 
activate the control surface actuator. 



HYDRO-MECHANICAL 

ENGINE PUMP VALVE ACTUATOR 




PILOT ELECTRO-MECHANICAL 

CONTROLLER 




Mechanical 

Hydraulic 

Electrical 



Figure 3.6. Fly-by-Hire Control System Hechanization 



The functional design cf the F/A-18 Digital Fly-by-Wire 
(DFBW) flight control system is illustrated in Figure 3.7. 
The basic mechanical and electrical FCS subsystems are 
diagrammed in Figure 3.8. The basic hydraulic FCS 
subsystems are depicted in Figure 3.9. Note the mechanical 
back-up components for controlling the pitch and roll motion 
of the aircraft. 
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Figure 3.7. F/&-18 FCS Functional Diagram 



30 




PRIMARY SYSTEM - QUADRUPLE* CONTROL^Y-WIRE 

BACKUP SYSTEMS • OIRECT ELECTRIC LINK 
TO ALL SURFACES 

• MECHANICAL TO STABILIZER 
FOR PITCH AND ROLL 



TWIN RUDDERS 





Figure 3.9. F/i-18 PCS Hydraulic Subsystem Diagram 
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IV. FCS FAILURE^ DAM AGE MODES IDENTIFICATION 

A. SYSTEM VULNERABILITY CONTRIBUTIONS 

Each individual component of an aircraft has a level of 
vulnerability that contributes to the overall vulnerability 
of the aircraft. Certain components contribute more than 
others, and those components which, when damaged or 
destroyed, lead to an aircraft loss are the ones of interest 
here. These components are known as critical components. 
The systemmatic identification of the critical components 
and the quantification of the vulnerability of individual 
components is a part of the overall aircraft vulnerability 
assessment. As the vulnerability contribution of each 
component, subsystem and system is assessed, various methods 
may be implemented to reduce the overall aircraft 
vulnerability. The vulnerability reduction technique (s) 
chosen for implementation in the FCS must allow the FCS 
design to remain within the constraints of cost, weight, 
performance, accessibility, and maintainability, et cetera 
imposed by contractual agreement. 
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B. IDENTIFICATION OF CRITICAL COMPONENTS 

One purpose of a vulnerability assessment is the 
identification of those components whose damage or loss 
could lead to an aircraft kill. A general procedure has 
been formulated for determining the critical components, 
their possible damage or failure modes, and the effects of 
the damage or failure on the continued operation of the 
aircraft [ Hef . 1 ]. 

Fundamentally, the procedure is comprised of three 
steps: 

(1) selection of an aircraft kill level. 

(2) formulation of a complete technical and functional 
description of the aircraft. 

(3) the identification and delineation of the critical 
components. 

1. Ai rcr a ft Kill Lev els 

Combat damaged aircraft and aircraft systems suffer 
performance degradations in varying degrees. The level to 
which the performance degradation progresses can, in 
general, be categorized as an attrition kill, a mission 
abort kill, or a forced landing kill. 
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An attrition kill is defined as that measure of 
aircraft damage that results in the loss of the aircraft 
from the inventory. Repairabili ty and economy of repair are 
factors which may contribute to to an attrition kill without 
the physical loss of the aircraft. However, it is the 
elapsed time from damage onset to eventual aircraft less 
which provides the scale with which to differentiate between 
attrition kill levels. Several attrition kill levels have 
been defined; such as "KK", n K", "A", and 11 B", impressed on 
a time to aircraft loss scale. Detailed kill level 

descriptions are contained within DOD 

MIL-STD-336-1 [Eef. 2]. 

A mission abort kill is defined as that measure of 
aircraft damage which results in an aircraft failing to 
complete its assigned mission, but that dees not result in a 
loss of the aircraft from the inventory. 

A forced landing kill, specifically applicable to 
helicopters, VTOL, and certain V/STOL aircraft, is defined 
as that measure of aircraft damage that causes the pilot to 
land his aircraft short of the intended destination, and the 
failure to do so would result in the destruction of the 
aircraft. 
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2. Air craf t Te c hni cal an d Functional Da scri p- io n 

At each successive stage of the aircraft design 
process, the technical and functional descriptions of 
aircraft systems and components become better defined. 
These descriptions, with individual component and systems 
dimensions, materials, operations and functions interfaces, 
scale and perspective drawings, and aircraft location 
profiles, comprise the detailed technical base for use in 
the vulnerability assessment. Gathering and continuously 
updating this data base, as it is formulated, should be 
given a very high priority. 

3- Critical Component Identification Procedure 

A sequenced procedure has been formulated to 
identify the critical components [Ref. 1]. The first step 
in this analysis procedure for the PCS is to identify the 
flight essential functions that the FTS must perform in 
order to continue to accomplish the aircraft's mission. The 
second step is to identify those FCS subsystems and 
components that provide or perform the essential functions. 
The third step is to conduct a failure mode and effects 
analysis (FMEA) and/or a fault tree analysis (FTA) to 
identify the relationship between the individual component 
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or subsystem failure and the essential function (s) it 
provides or performs. The fourth step, the damage modes and 
effects analysis (DMEA) , consists of relating the component 
or subsystem failure modes to combat damage causes. The 
final step in the process, the presentation of the results, 
is often expressed in a logical sequence Known as a kill 
expression, or represented graphically as a kill tree. 

4 . Proc ed ural E xam ple - Generic DFBW PCS 

To illustrate this dynamic process, the flight 
control system of a generic fighter/attack aircraft will be 
utilized. The time scale of a " B" level attrition kill will 
be imposed for illustrative purposes. 

A schematic representation of the example DFBW PCS 
layout is shown in Figure 4. 1. Specific technical and 
functional interfaces are depicted in Figure 4.2. The FCS 
utilizes dual, high speed digital computers, quadruple 
transmission signal paths, two independent hydraulic 
systems, and dual, tandem hydraulic actuators at all control 
surfaces. No back-up mechanical control linkage is 
provided. 

Flight essential functions are those that are 
required tc sustain controlled flight with qualities not 
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Figure 4.1. Generic DFBS FCS Illustration 



less than level 3 as defined by MIL-F-8735C [Ref. 3]. Each 
mission phase constitutes an evaluation point in the 
process. Mission phases foe a typical multipurpose 
f ighter/att ack aircraft include takeoff, climb, outbound 
cruise, descent, target ingress, ordnance delivery, target 
egress, climb, inbound cruise, descent, and landing, as 
shown in Figure 4.3. Figure 4.4 delineates those flight 
essential functions in a typical format for the example 
fighter/attack aircraft. 
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Figure 4.2. Technical/Functional Interfaces - DFB» FCS 



To fly and conduct the aircraft* s mission requires 
the continued operation cf those supporting systems or 
subsystems that provide or perform the essential FCS 
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3. Cruise 9. Cruise 

4. Descent 10. Descent 

5. Target Ingress 11. Landing 

6. Ordnance Delivery 

Figure 4.3. Fighter/Attack Mission Profile Phases 

function. The level of severity and time criticality of 
loss of these supporting systems or subsystems must be 
evaluated during this process step. Figure 4.5 depicts a 
sample tabulation of some of those major supporting systems 
and subsystems. In depth and detailed analyses of each 
individual supporting element must be carried out as each of 
■these elements becomes sufficiently defined during the 
design process. A sample tabulation of a more detailed 
analysis is presented in Figure 4.6. 
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Essential FCS Functions 
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Climb 
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X 




X 


Target 

Ingress 




X 




X 


Ordnance 

Delivery 




X 




X 
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X 




X 


Climb 




X 




X 


Cruise 




X 




X 


Descent 




X 




X 


Landing 




X 




X 



Figure 4.4. FCS Essential Functions vs. aission Phases 

Continuously updating the technical and functional 
data base provides t the basis and means for further 
refinements of the detailed supporting systems analysis. 

The third phase in the analysis procedure is the 
failure mode and effects analysis and/or the fault tree 
analysis. The FME A is a " bo t toms- up” procedure that 
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Essential FCS Functions 



Supporting . Provide. Controlled . Provide Continuous 

System/Subsystem . Flight . System Status 

Functions . . Monitoring 



• 

Electrical 
Powe r 

• 


X 




X 




• 

Hydraulic 

Power 

• 


X 








• 

Airconditioning/ . 

Environmental 

Control 

• 


X 






• 


• 

Motion Sensor 
Input 

• 


X 






• 



Figure 4.5. Basic Systems/Subsystems Supporting The FCS. 



identifies all possible failure modes of a component or 
system, documents these failure modes, and determines the 
effect of each failure mode on the performance of the system 
as a whole. The details of the FMEA process, and specific 
procedures can be found in MIL-STD-785 [Ref. 4], 

Component failure modes generally considered in an 
FMEA include failure to operate, failure to terminate 
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Essential FCS Functions 



Detailed 

Supporting . Provide Controlled . Provide Continuous 

System/ . Flight . System Status 

Subsystem . . Monitoring 

Functions 
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X 


X 


Provide 
Continuous 
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Signal Path 


X 


X 


Provide 
Continuous 
Sensor Input . 


X 


X 


Figure 4.6. Detailed 


Support 


S ystems/Subsystems Analysis. 
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operation, premature operation, aid degraded or 
out-of-tolerance operation. Unique failure modes may be 
singularly inserted in this stage of the process. An 
example FMEA summary report for a hydraulic control surface 
actuator for the example FCS is presented in Figure 4.7. 



Aircraft 

System 


Subsystem 

Component Location 


Failure 

Mode 


Effect on 
Subsystem 


Effect of 
Degraded 
Subsystem 
on Aircraft 


Aircraft 

Kill 

Category 


Supporting 

References 


Comments 




Fit. 

Controls 


Hyd. Act. 

#xxxx 


Vert. Stab. 


Jammed 


Rudder 

Hardover 


Balanced 
flight 
obtainable 
with cross- 
control i 
aircraft 
uncontrollable 
in PA config. 


"B"; 

aircraft 
uncontrol- 
lable in 
landing 
configuration 


#1,5,7 


2,4 








Severed 


Rudder 

Trails 


Balanced 
flight 
obtainable 
with cross- 
control or 
differential 
engine power 


— , aircraft 
can fly and 
land with 
other control 
surfaces 
functioning 


#3 


6 



Figure 4.7. Example FMEA Summary Report 



Hyd. Actuator 
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The actuator becomes a critical component for an 
attrition kill if it jams the control surface into a 
hard-over condition, but it is not a critical component if 
it allows the control surface to remain unjammed. 

Another analysis procedure, the Fault Tree Analysis 
employs a "top- down" approach [Ref. 5]. This approach 
differs from the FMEA in that it assumes an undesired even 
and systematically determines what failure or sequence of 
failures could cause the undesired outcome. A segment of a 
FT A for the example FCS is presented in Figure 4.8. The 
symbology utilized in the FT A analysis is common to logic 
systems and, as such, the FTA is often selected for its 
suitability with computational systems. 

FCS faiLure modes that cculd result in aircraft 
attrition have been identified for the example FCS and are 
presented in Table III. 

The FMEA and FTA related failure modes and effects 
but did not distinguish the possible cause (s) of the 
failure. The Damage Mode and Effects Analysis (DMEA) 
provides this essential relationship. In the DMEA, the 
component and subsystem failures are related zo specific 
damage causing mechanisms and damage processes. Included i 
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Figure 4.8. A Segment Of An FT A For The Example PCS 
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TABLE III 



Example F2S Failure Modes - Attrition Kill 
(D Loss of control inputs 

(2) Loss of motion sensor data 

(3) Loss of digital computer control 

(4) Loss of electrical power to computer (s) 

(5) Loss of control signal path 

(6) Loss of hydraulic system power 

(7) Loss of control surface actuator 

(8) Loss of control surface 



these primary damage mechanisms are projectiles and 
fragments, blast effects from high explosive warheads, 
incendiary particles, and High Energy Lasers (HEL) . The 
damage these agents may cause includes severed electrical 
power distribution lines, sensor signal paths, and control 
signal transmission lines; jammed mechanical linkages and 
servoactuators ; loss of hydraulic pressure and hydraulic 
fluid loss/leakage; fire (aggravated by petroleum based 
hydraulic fluid) ; HEL burn-through and high temperature 
heating or melting of PCS components, and certain 
electromagnetic incompatibilities with components, devices, 
cables, wiring, and connectors. Secondary damage mechanisms 
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resulting from the impact of the primary agents on the FCS 
include fire, explosion, spalling, structural deformation, 
sparks, and fluid leakage. The DMEA process evaluates cause 
and effect, and quantifies the likelihood of the outcome. 
Secondary damage causes, resulting from the primary damage 
mechanism or process, are included in the evaluation during 
this analysis phase. Detailed descriptions of the 
vulnerability assessment quantification process are 
presented in reference 1 and in MIL-STD-33 6- 1 [Ref. 2]. 

Failure modes can be categorized and qualitatively 
aligned with the various damage causing devices or events. 
Figure 4.9 correllates the example FCS failure modes 
presented in Table III with common conventional weapons 
damage causing agents. 

The next step in the vulnerability assessment 
process is the actual determination of the critical 
components fcr the selected kill level assessed. 
Distinguishing between redundant and non-redundant critical 
components is essential in this phase of the analysis. To 
clarify this important distinction, a set of components is 
defined to be redundant if the loss of one or more than one, 
but not all of the components, does not result in the loss 



47 



Failure/Damage Modes 



Damage Mechanisms 









Penetrator 


Continuous Rod 


Fragment 


Blast 


Fire 


Radiation 





Structural Failure Modes 
Area Removal 
Overpressure 
Thermal Degradation 
Penetration 

Electrical Power System 
Failure Modes 

Line Severance 

Grounding 

Avionics System Failure 
Modes 

Failure to Operate 

Degraded Operations 

Hydraulic Power System 
Failure Modes 

Loss of Fluid 

Loss of Pressure 

Jammed Actuator 



Figure 4.9. PCS Failure Hodes/Damage Causing Agents 

of the essential function these components perform. If this 
distinction can not be made, the components are 
non- redundant . As an example, the quadruple control signal 

paths shown for the example FCS form a multiply redundant 
system because the essential function of providing a 
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continuous signal path is maintained even though one or more 
than one individual path may be rendered discontinuous. 

Another distinction regarding redundancy must be 
made. The term "analytical redundancy" refers to a method 
whereby a computational algorithm is used to predict an end 
event or parameter. Then the prediction and a sensor 
derived measurement are compared, and subsequent action (s) 
taken. While not fitting the precise definition of 
redundancy, the computational results can be suitably used 
in lieu of the sensor output in certain circumstances. 

The determination of the critical components and the 
presentation format are often presented in a "kill tree" or 
"kill expression." Referring to that portion of the kill 
tree shown in Figure 4.10, the physical relationship to a 
tree is apparent. The severance of sufficient trunk 
segments may result in the loss of the tree and in the case 
of the FCS, the loss of the aircraft. 

Once identified, the critical components may be 
subject to various engineering redesigns to reduce their 
contribution to the vulnerability of the aircraft. 
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Figure 4.10. FCS Conventional Weapons Kill Tree 
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V. 



FCS SURVIV ABILITY DESIGN GUIDELINES 

A. GENERAL FCS EES IGN PRINCIPLES 

General design principles to reduce vulnerability should 
be exercised to the fullest extent possible throughout the 
FCS design process. Commencing with the initial design 
phases, a full measure of consideration must be given to the 
combat survivability of the flight control system. Of 
course, the desire for increased survivability of the flight 
control system must be prudently balanced with the other 
requirements of reliability, maintainability, accessibility, 
repairability, and safety. Concurrently, the fullest 
measure of performance must be achieved, and all these 
factors must be suitably combined within stringent cost and 
weight constraints. In the end, the design of the FCS of 
military combat aircraft must include suitable protection 
from the primary damage causing mechanisms of conventional 
threat weapons systems. 

The six survivability enhancement concepts developed in 
Chapter II (Table II, page 19) provide the foundation for 
the general FCS design principles. In general, the FCS 
design principles contain provision for component location 
and shielding to reduce potential damage risks; elimination 
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single point failure 



(via redesign) of high risk, 
components; component redundancy with adequate separation of 
redundant components to maintain the essential flight 
control function; and the incorporation of passive and 
active damage suppression devices and techniques tc minimize 
the effects of incurred damage. A flight control system 
design that includes no single point kill possibilities 
should be considered a design goal. 

B. SURVIVABILITY DESIGN GUIDELINES FOR FBW FCS 

Specific survivability design guidelines applicable tc 
the individual components and subsystems of a Fly-by-Mire 
Flight Control System have been formulated and are herein 
presented. The decision to incorporate any or all of the 
design guidelines must be made prudently and with sound 
engineering judgement. 

1. Mechanical System Components 

a) Flight Control Surface Panels 

Mhere possible: 

• Design control surface panels of lightweight 
composite materials which exhibit hign 
strength-t o-weight ratios and integral 
redundant load carrying capability for high 
ballistic damage tolerance. 

• Incorporate smooth surface transitions to 
reduce aircraft signatures. 

• Incorporate multiple surface panels on each 
control plane to provide redundant control 
surfaces for maximum reconfigurability. 

• Utilize heat resistant surface material or 
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ablative materials to rerard HEL barnthrough. 
b) Hinges/Control Linkages/Bearing Assemblies 
Where possible: 



• Design components to be jam-free. 

• Utilize self-aligning bearings (e.g. 
tri-p.ivot bearings) to minimize misalignment 
and jamming due to control rod, actuator arm, 
or control surface panel deformation. 

• Minimize the length of mechanical control 
linkages to reduce the probability of 
deformation or distortion. 

• Utilize ballistically damaae tolerant 
composite materials for control rods and 
torque tubes. 

• Design fairleads, bellcranks, and idler 
assemblies to allow a measure of functional 
performance if damaged. 

• Install primary drive motors, control 
linkages, interconnecting devices, and 
bearing assemblies in close proximity to 
primary structural members to take advantage 
of the shielding afforded by the primary 
structure. 

• Ensure that that all control surfaces are . 
fitted with a "trail safe" positioning device 
to prevent hardover conditions in the event 
of the loss of the drive linkage. 



c) Servcactuators 



Where possible: 



• Design all servoactuators with redundant 
power sources (e.g. dual cylinder actuators). 

• Design actuator pistons of frangible or 
malleable materials to minimize the 
possibility of jamming. 

• Design actuator barrel assemblies of high 
strength steel for high ballistic resistance 
(e.g. Electro-Slag Remelt (ESR) Steel). 

• Design the actuator outer-barrel assemblies 
to prevent crack propogation. 

• Install servoactuators in close proximity tc 
primary structural members for maximum 
shielding . 

• Install rate and position feedback linkages 
m close proximity to the servoactuator 
assembly for maximum shielding. 
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• Utilize integral reservoir, pump, and 
electric power packages when possible (e.a. 
Integrated Actuator Packages (IAP) ) . 

• Incorporate metallic seals in place of 
polymeric seals for HEL pr erection. 

• Coat actuator housings with high temperature 
resistant or ablative materials for HEL 
burnthrough protection. 

• Incorporate high strength ablative armor in 
areas of critical components. 

• Incorporate very high signal- to-r.oise ratio 
servovalves for increased EMI tolerance. 



2. Hydr auli c Po wer S vst sms 



a) Fluid Pressure Generation Subsystems 



Where possible: 



• Design hydraulic power sources to be sinqle 
or double redundant (e.g. separate dual or 
triple hydraulic power sources) . 

• Physically separate hydraulic power sources 
as much as possible to reduce the single shot 
kill probability of a multiple hydraulic 
system. 

• Install power sources in close proximity to 
main structural members to provide maximum 
shielding. 

• Incorporate high temperature resistant or 
ablative material coatings on hydraulic pump 
cases to increase HEL burnthrougn tolerance. 



b) Fluid Pressure Distribution Subsystems 



Where possible: 



• Design fluid pressure distribution systems of 
high strength, high temperature tolerant 
steel lines. 

• Incorporate single or double redundant 
distribution lines on each separate fluid 
pressure system. 

• Incorporate flow sensors, check valves, and 
switching circuits to bypass damaged segments 
of distribution lines. 

• Incorporate reservoir level sensing devices 
to isolate damaged distribution lines to 
prevent fluid loss. 

• Install distribution lines in close proximity 
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to main structural members to maximize 
shielding . 

• Utilize very high pressure (i.e. 4000-6000 
psi) systems to reduce presented area. 

• Utilize high temperature resistant 
synthetic-based hydraulic fluid to reduce or 
eliminate fire potential. 



3 . El ectronic S yst em Components 



a) Flight Control Avionics Components 



where possible: 



• Design all primary FBW FCS avionics 
components with multiple redundancy (e.a. 
multiple LVDT control input sensors on each 
control axis input, and multiple aiaital 
flight control computers). 

• Separate redundant avionics comDcner.ts to 
minimize single shot kill probabilities. 

• Design all avionics component cases of high 
strength steel for maximum ballistic 
resistance . 

• Coat all avionics component cases with high 
temperature resistant or ablative materials- 
for maximum HEL burnthrough protection. 

• Design shock mounts for internal and external 
components to withstand vibration and weapons 
induced shock loads. 

• Install avionics components in close 
proximity to primary structural members for 
maximum shielding. 

• Incorporate high temperature resistant or 
ablative armor in areas surrounding critical 
components. 

• Design electronic components with suitable 
particulate, vapor, and moisture protection. 



b) Electronic Circuit Design 



where possible: 



• Design input/output circuits of very high 
Signal -to- Noise (S/N) ratio components for 
maximum EMI protection. 

• Minimize capacitive and inductive 
cross-coupling in electronic circuits. 

• Incorporate suitable self-protect, energy 
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dissipative circuits to provide lightning and 
EMI/EMP protection (e.g. fusible links, 
filters, or spark-gap devices) . 

• Provide separate and redundant analog 

channels, with separate voting logic, as a 
backup to the digital controller. 



c) Signal Transmission Paths 



Where possible: 



• Design single or double redundant signal 
paths between each component or element in a 
signal path. 

• Provide suitable separation between redundant 
signal transmission lines to reduce the 
single shot kill probability. 

• Route signal transmission lines in close 
proximity to primary structural members for 
maximum shielding. 

• Provide adequate electromagnetic shielding to 
reduce EMI. 

• Utilize high temperature resistant wire 
covering to maximize thermal/fire protection 
and to minimize HEL burnthrough. 



d) External Sensors/Ancillary Subsystems - 



Where possible: 



• Design multiple redundant external sensors 
and ancillary subsystems (e.g. Air Data 
Computers, and Angle of Attack systems) . 

• Incorporate high temperature resistant or 
ablative material armor for thermal, HEL and 
ballistic damage tolerance. 

• Provide separate, redundant motion and rate 
sensors on each of the three aircraft axes. 

• Mount sensors to primary structural members 
for maximum shielding. 

• Provide analytically redundant sensory 
outputs for use as checks, and as potential 
back-ups. 

• Provide adequate built-in test circuits with 
suitable failure warning indications. 

• Incorporate separate and widely displaced 
sensor signal transmission paths. 



e) Pilot Control Inputs 
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Where possible: 



• Design redundant control stick and rudder 
input sensor contacts. 



• Utilize sequenced voting logic and 
control commands to each of the 
processing units of the flight 
computer (s ) . 



multiplex 
cent ral 
control 



• Incorporate separate and widely displaced 
input command signal transmission paths. 



4. Electrical Power System 



a) Electrical Power Generation 



Where possible: 



• Design electrical power generation systems to 
be multiply redundant (e.g. dual generators, 
each with single generator capability) . 

• Incorporate multiply redundant AC/DC 
conversion elements. 

• Utilize au tcmatic/manual or manually 
activated ram air turbine emergency 
generators, with separate AC/DC conversion 
elements. 

• Design battery back-up systems.' 



b) Electrical Power Distribution 



Where possible: 



• Design electrical bus distribution systems 
for "cross-over" transient- free operation. 

• Incorporate redundant control signal/power 
wiring to IAP (if utilized) . 



5. Envi ro nm ent al Con trol System 



Where possible: 



• Design separate and redundant a priori 
distributed heating and cooling, 

? ressurizaticn, and volumetric flow systems 
o critical components (e.g. flight control 
computer (s) ) . 

• Incorporate fail-safe temperature, pressure, 
and volume flow sensors (i.e. a safe 
operating condition is maintained should a 
failure occur) . 
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• Proved® ram air emergency cooling to heat 
sensitive components. 

• Design adeguate particulate, vapor, and 
moisture control devices m primary 
emergency cooling and pressurization sy 
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V) 

i r> pi 



VI. SUMMARY AND RECOMMENDATIONS 

A. SUMMARY 

In summary, it has been the author's desire to present 
in a single document a clear-cut set of guidelines for the 
development of aircraft flight control systems with specific 
emphasis on increasing the combat survivability of aircraft 
equipped with FBW flight control systems. The material 
presented and the guidelines delineated have resulted in a 
document that is as complete and concise as any single 
source document can be when dealing with a fast-paced, 
highly complex technical subject. This document should 
therefore be viewed as a dynamic fool that reflects a 
continuous chain of ongoing thoughts and actions to 
constantly update and strengthen the quality, capability and 
survivability of the combat systems of our Armed Forces. 

B. RECOMMENDATIONS FOR FUTURE ACTIONS 

Enhanced survivability alternatives achievable through 
digital FBW FCS technology should be investigated fully. 
One such survivability enhancement alternative, achievable 
through digital technology, is a "self-healing", 
reconfigur able aircraft flight control system. 
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Consider for a moment that you are the pilot of an 
aircraft that has just been hit by enemy ground-fire. You 
feel the dull thud as the enemy projectile impacts your 
aircraft's aft fuselage area and now you sense the aircraft 
beginning to pitch and roll without command. Your survival 
instinct tells you to try every possible combination of 
stick and rudder input to counter the out-of-control 
aircraft motion. Nothing seems to correct the 

situation your final thought prior to ejecting from 

your stricken craft is "if only " 

This hypothetical example is but one of many possible 
combat related incidents that might be resolved in another 
way through the use of digital technology. Consider the 
possibilities afforded by digital technology in regaining 
control over a combat damaged aircraft as in the 
aforementioned example. With one of the horizontal 
stabilators gone, an alternate combination of primary and 
secondary control surfaces might be commanded by the 
computer to return the aircraft to controlled flight. This 
proposed survivability enhancement alternative could be 
obtained with minimal additions to present digital 
fly-by-wire flight control configurations. The addition of 
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a sensor suite, to detect and identify damaged flight 
control components, and a computational algorithm to 
reconfigure the aircraft control surfaces, similar in nature 
to that used in artificially intelligent robot devices, are 
all that is required. Without question, successful! 
achievement of such an adventuresome engineering task would 
require a dedicated effort. Outlined in the following, is a 
plan to accomplish such a project. It is the author's 
opinion that sincere thought and consideration should be 
given to such an undertaking in the near term. 

A plan to develop an artificially intelligent, 
reconfigurable flight control system would require detailed 
engineering Analyses of the following areas: 

• Computational analysis, and wind tunnel determination 
of aerodynamic lift, drag and moment coefficients on 
simulated combat damaged aircraft models (e.g. model 
testing of missing, jammed or trai ling-fre e control 
surfaces in single and multiple combinations). 

• Development of control surface reconfigurability 
alternatives . 

• Development of suitable sensors to detect the various 
levels and modes of combat damage. 

• Development of a sequenced logic or built-in test 
routine to verify flight control system configuration 
and status. 

It is the author's opinion that the fundamental 
technology and expertise are present within the 
military-industrial community to achieve the aforementioned 
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survivability enhancement alternative at low technological 
risk and low cost. It is hoped that tomorrow's history doe 
not show the way to progress in aircraft survivability. 
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